Introduce internal/contracts/vocabulary for state/role/error sentinels,
alias through docgov, and retarget hot production consumers so
coordinator no longer imports docgov for vocabulary-only use.
Replace FakeActionOwner with QueryOwner+QueryGuard at the composition
root; DispatchEligible reuses claim/execute/recover so confirm stays
zero-write before dispatch and default tier remains legacy.
Remove production *pgxpool.Pool from Server, centralize domain→HTTP
status mapping, and expose Runtime ports for task-store readiness,
duty heal, and artifact vault registry. Allow app→docduty for heal wiring.
Move document_records duty-slot writes into docgov, project ledger
heads through docgov/freedoc ports, and workspace deliverable I/O
through DeliverableStore so arch-check baseline drops to sql_write:1
path:13.
Invert chat dependencies onto composition-root adapters, replace
AssembleRequest coordinator embeds with local DTOs, and drop the
chat→app/* allowlist edges so arch-check can enforce the boundary.
Invert chat dependencies on chatflow/intentflow/stageflow through
composition-root adapters; replace AssembleRequest coordinator embeds
with local DTOs and tighten the module-boundaries allowlist.
The flag reaches all three compose app services and the sysadmin catalog, and unknown values stay on the existing hard block.
Co-authored-by: Cursor <cursoragent@cursor.com>
A new recheck mark is posted into the actor's existing project session, and a downstream-impact event does the same. Asking about what a change affects still resolves to impact analysis.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the record tables when migration 00059 is present, and hide statements from documents the caller cannot see.
Co-authored-by: Cursor <cursoragent@cursor.com>
Absorb stalled capability fixes and avoid goose out-of-order on schema 57 DBs by shipping chat_summaries as 00058.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PATCH /doc-tasks/{taskKey}/duties that updates live snapshot,
assignments, and document_records while blocking when a squad run holds
the document lease. Planning PUT remains PLAN_FROZEN.
Co-authored-by: Cursor <cursoragent@cursor.com>
The narrator only received counts, so it could not describe the actual change. Caps keep the full document out and leave the input digest unchanged; the flag stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Published manifests now use bd_/pm_/tm_/sw_ prefixes so workflows cannot share a doc id. Frozen instances keep the old keys; lookup, templates, and duty checks treat the two names as the same task.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the skipped client work_dir resume coverage that targeted a deleted
entry point, and document why the real-PI stop-gate stays redirected to
internal/server to avoid an import cycle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Adapt sysadmin.AuthorOnlyPolicySource at the composition root so
projectinstance stays within module-boundary allowlists.
Co-authored-by: Cursor <cursoragent@cursor.com>
- new internal/sysadmin package (overview/kb/features/settings) with small
port interfaces; business packages stay unaware of sysadmin
- new routes /api/v1/admin/system/{overview,kb,features,settings} guarded
by requireSystemAdmin
- goose 00049: system_settings table (key/jsonb value, updated_by/at)
- SettingSpec whitelist registry with DB > env > default precedence
- register sysadmin in module-boundaries.yaml (archtest rules)
Software projects mount only bootstrap/delivery keys and skip the medical
seven-template clone. SWBOOT-10 stays a fail-closed stub.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rules that already split skip the LLM. Independent flags stay off by
default and do not raise MULTI_INTENT_PLAN_TIER.
Co-authored-by: Cursor <cursoragent@cursor.com>
Flag-on CreateAgentCandidate asks the product PI runner for
change_report_narrative_v1 after the real digest is known; timeout
and malformed payloads stay full fallback. Default flag remains off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Enable SEMANTIC_SUMMARY_SHADOW to call the product PI runner on authorized messages only, keep REPLACE unwired, and record MiniMax evidence for the D3 matrix close.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register dry-run adapters via BuildOwnerMux when independent flags are on;
U9 stub fail-closes on malformed/timeout/out-of-bounds without raising PlanTier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep durable fav unregistered and fail-closed; CLI only prints status and
remaining-port inventory without destructive backfill/recover commands.
Co-authored-by: Cursor <cursoragent@cursor.com>
GenerateRollingSummary filters to authorized-visible messages; digest API
exposes shadow/freshness without enabling REPLACE.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the U8 stop-gate with a PG+PI confirm/generate harness and add a
mixed-duty governance long chain covering cross-user approve and none
non-blocking advance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize empty TEXT[] binds, isolate step-changed aggregates from plan
revision uniqueness, propagate AdvanceEligible errors, and emit
taskrun.completed to the registered notify consumer so finalize no longer
rolls back live receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist ComboNeedsConfirm plans at confirm tier without executing writes, then run task.run via OwnerMux and a stable idempotency key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Confirmation stays a command receipt; FakeActionOwner now fail-closes on revoke and resource version drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
Append awaiting/step/completed envelopes in the command UoW and project them without changing dispatcher leases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add the app/intentflow skeleton so HITL state, error codes, REST shapes, and BatchActionPolicy live outside intent and default to the legacy tier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Durable notify/advance/projection are live on shared dev, so composition roots must not assign OnOutbox or AddOnApprovedHook. Bind helpers remain for tests and a rollback window.
Co-authored-by: Cursor <cursoragent@cursor.com>
WeiCHEN